prosze o sprawdzenie loga

[karolfu]

Witam!

Nie jestem w tych sprawach biegły i pewnie dlatego mam kłopot z otwierającą się samoistnie przeglądarką... Wyskakują później strony z reklamami jakiegoś banku, albo jeszcze czegoś innego... A to log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:14:33, on 2007-08-25
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Creative\SBAudigy4\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe
C:\WINNT\system32\CTHELPER.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\windows\system32\msnmsg.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Creative\SBAudigy4\Entertainment Center\RcMan.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
C:\Program Files\Acronis\PrivacyExpert\Shield.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\OpenOffice.ux.pl 2.2.1\program\soffice.exe
C:\Program Files\OpenOffice.ux.pl 2.2.1\program\soffice.BIN
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINNT\system32\CTsvcCDA.EXE
C:\WINNT\System32\nvsvc32.exe
C:\Program Files\Common Files\Acronis\Malware Shield\psh_svc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Fu\Pulpit\progsy\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Acronis Popup Blocker - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - C:\Program Files\Acronis\PrivacyExpert\Blocker.dll
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy4\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [MonAppli] C:\windows\system32\msnmsg.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\SBAudigy4\Entertainment Center\RcMan.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe /SCB
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Shield] C:\Program Files\Acronis\PrivacyExpert\Shield.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.ux.pl 2.2.1.lnk = C:\Program Files\OpenOffice.ux.pl 2.2.1\program\quickstart.exe
O4 - Startup: µTorrent.lnk = C:\Program Files\uTorrent\uTorrent.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: Acronis Pop-up Blocker - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\Program Files\Acronis\PrivacyExpert\Blocker.dll
O9 - Extra 'Tools' menuitem: Acronis Pop-up Blocker - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\Program Files\Acronis\PrivacyExpert\Blocker.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTsvcCDA.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Acronis Malware Shield Service (psh_svc) - Unknown owner - C:\Program Files\Common Files\Acronis\Malware Shield\psh_svc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 8373 bytes

Proszę o pomoc i pozdrawiam!
Karol

[wojtas]

odinstaluj w dodaj usun programy: Desktop Messenger

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [MonAppli] C:\windows\system32\msnmsg.exe

skasuj te ^^ wpisy w hijacku + pogrubiony wywal do kosza

daj loga z combofixa oraz nowy log z hijacka

[karolfu]

Skasowałem 2 pierwsze wpisy, plik z trzeciego wyrzuciłem do kosza. Nie odinstalowałem Desktop Messengera, bo to program logitecha do mojej klawiatury... Chyba, że na 100 % to sprawia jakieś kłopoty, to to zrobię.

To log z ComboFix'a:

ComboFix 07-08-25.2 - "Fu" 2007-08-27 8:29:41.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.219 [GMT 2:00]
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-07-27 to 2007-08-27 )))))))))))))))))))))))))))))))


2007-08-27 08:28 51,200 --a------ C:\WINNT\nircmd.exe
2007-08-24 22:26 <DIR> d-------- C:\WINNT\system32\NtmsData
2007-08-24 21:31 10,872 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2007-08-24 19:04 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\Acronis
2007-08-24 18:58 81,984 --a------ C:\WINNT\system32\drivers\psh_drv.sys
2007-08-24 18:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Acronis
2007-08-24 18:54 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\AdobeUM
2007-08-24 18:44 <DIR> d-------- C:\Program Files\PowerQuest
2007-08-24 17:54 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-08-24 12:56 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\Ahead
2007-08-24 12:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Ahead
2007-08-24 12:49 <DIR> d-------- C:\Program Files\Nero
2007-08-24 12:49 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-08-24 12:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Nero
2007-08-24 11:47 <DIR> d-------- C:\Program Files\Creative Professional
2007-08-24 11:46 59,264 --a------ C:\WINNT\system32\drivers\USBAUDIO.sys
2007-08-24 11:46 31,616 --a------ C:\WINNT\system32\drivers\usbccgp.sys
2007-08-24 11:23 <DIR> d-------- C:\Program Files\SimSynth
2007-08-24 11:22 <DIR> d-------- C:\DOCUME~1\Fu\vst plugins
2007-08-24 11:19 180,224 --a------ C:\WINNT\system32\ReWire.dll
2007-08-24 11:19 118,784 --a------ C:\WINNT\dsdxirmv.exe
2007-08-24 10:35 <DIR> d-------- C:\Program Files\Yahoo!
2007-08-24 10:35 <DIR> d-------- C:\Program Files\CCleaner
2007-08-23 17:43 <DIR> d-------- C:\Program Files\Lavasoft
2007-08-23 17:43 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\Lavasoft
2007-08-23 13:35 9,464 --------- C:\WINNT\system32\drivers\cdralw2k.sys
2007-08-23 13:35 9,336 --------- C:\WINNT\system32\drivers\cdr4_xp.sys
2007-08-23 13:35 43,528 --------- C:\WINNT\system32\drivers\PxHelp20.sys
2007-08-23 13:35 129,784 --------- C:\WINNT\system32\pxafs.dll
2007-08-23 13:32 <DIR> d-------- C:\Program Files\Winamp
2007-08-23 13:31 <DIR> d-------- C:\windows
2007-08-23 12:50 <DIR> d-------- C:\Program Files\TC PowerPack
2007-08-23 12:32 <DIR> d-------- C:\Program Files\Jufsoft
2007-08-23 09:04 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\Help
2007-08-22 20:41 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-08-22 20:39 685,816 --a------ C:\WINNT\system32\drivers\sptd.sys
2007-08-21 08:14 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\OpenOffice.ux.pl2
2007-08-21 08:11 <DIR> d-------- C:\Program Files\OpenOffice.ux.pl 2.2.1
2007-08-21 00:33 127,034 -r------- C:\WINNT\bwUnin-8.1.1.50-8876480SL.exe
2007-08-21 00:28 <DIR> d-------- C:\Program Files\Switch Off
2007-08-17 13:53 97,248 --a------ C:\WINNT\system32\drivers\snapman.sys
2007-08-17 13:53 <DIR> d-------- C:\Program Files\Common Files\Acronis
2007-08-17 13:53 <DIR> d-------- C:\Program Files\Acronis
2007-08-17 00:40 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\Cakewalk
2007-08-17 00:25 487,424 --a------ C:\WINNT\system32\msvcp70.dll
2007-08-17 00:25 344,064 --a------ C:\WINNT\system32\msvcr70.dll
2007-08-17 00:25 <DIR> d-------- C:\Program Files\Cakewalk
2007-08-17 00:25 <DIR> d-------- C:\Cakewalk Projects
2007-08-16 23:55 <DIR> d-------- C:\WINNT\system32\appmgmt
2007-08-16 10:28 <DIR> d-------- C:\Program Files\Audacity
2007-08-16 09:44 <DIR> d-------- C:\Images
2007-08-16 09:43 <DIR> d-------- C:\Audio
2007-08-16 09:41 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\Steinberg
2007-08-16 09:19 <DIR> d-------- C:\Program Files\Steinberg
2007-08-16 09:19 <DIR> d-------- C:\Program Files\Pinnacle
2007-08-16 09:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Pinnacle
2007-08-15 16:02 <DIR> d--hs---- C:\RECYCLER
2007-08-14 19:01 <DIR> d-------- C:\Program Files\uTorrent
2007-08-14 19:01 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\uTorrent
2007-08-14 02:07 <DIR> d-------- C:\Program Files\AusLogics Emergency Recovery
2007-08-14 01:29 71,168 --a------ C:\WINNT\system32\drivers\ni_usb.sys
2007-08-14 01:29 23,168 --a------ C:\WINNT\system32\drivers\NiBoot.sys
2007-08-14 01:29 22,016 --a------ C:\WINNT\system32\drivers\ni_avs.sys
2007-08-14 01:28 <DIR> d-------- C:\Program Files\Native Instruments
2007-08-14 01:22 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\vlc
2007-08-14 01:20 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\dvdcss
2007-08-14 01:07 86,016 --a------ C:\WINNT\system32\CNMCP66.exe
2007-08-14 01:07 7,680 --a------ C:\WINNT\system32\CNMVS66.DLL
2007-08-14 01:07 116,736 --a------ C:\WINNT\system32\CNMLM66.DLL
2007-08-14 01:07 <DIR> d--h----- C:\BJPrinter
2007-08-14 01:07 <DIR> d-------- C:\DOCUME~1\Fu\DANEAP~1\WinRAR
2007-08-14 01:06 <DIR> d-------- C:\Program Files\VideoLAN
2007-08-14 01:05 <DIR> d-------- C:\Program Files\SubEdit-Player
2007-08-14 01:03 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2007-08-14 00:57 769,536 --a------ C:\Temp\SFDNWIN.exe
2007-08-14 00:57 2,097,152 --a------ C:\Temp\autorun.bin
2007-08-14 00:57 <DIR> d-------- C:\Temp
2007-08-14 00:56 58,624 --a------ C:\WINNT\system32\drivers\redbook.sys
2007-08-14 00:56 3,072 --a------ C:\WINNT\system32\drivers\audstub.sys
2007-08-14 00:55 77,312 --a------ C:\WINNT\system32\usbui.dll
2007-08-14 00:55 5,504 --a------ C:\WINNT\system32\drivers\intelide.sys
2007-08-14 00:55 42,368 --a------ C:\WINNT\system32\drivers\AGP440.SYS
2007-08-14 00:55 20,992 --a------ C:\WINNT\system32\drivers\RTL8139.sys
2007-08-14 00:54 8,192 -ra------ C:\WINNT\system32\kbdhept.dll
2007-08-14 00:54 6,656 -ra------ C:\WINNT\system32\kbdhela3.dll
2007-08-14 00:54 6,144 -ra------ C:\WINNT\system32\kbdtuq.dll
2007-08-14 00:54 6,144 -ra------ C:\WINNT\system32\kbdtuf.dll
2007-08-14 00:54 6,144 -ra------ C:\WINNT\system32\kbdlv1.dll
2007-08-14 00:54 6,144 -ra------ C:\WINNT\system32\kbdlv.dll
2007-08-14 00:54 6,144 -ra------ C:\WINNT\system32\kbdhela2.dll
2007-08-14 00:54 6,144 -ra------ C:\WINNT\system32\kbdgkl.dll
2007-08-14 00:54 6,144 -ra------ C:\WINNT\system32\kbdest.dll
2007-08-14 00:54 5,632 -ra------ C:\WINNT\system32\kbdmon.dll
2007-08-14 00:54 5,632 -ra------ C:\WINNT\system32\kbdlt1.dll
2007-08-14 00:54 5,632 -ra------ C:\WINNT\system32\kbdlt.dll
2007-08-14 00:54 5,632 -ra------ C:\WINNT\system32\kbdkyr.dll
2007-08-14 00:54 5,632 -ra------ C:\WINNT\system32\kbdhe319.dll
2007-08-14 00:54 5,632 -ra------ C:\WINNT\system32\kbdhe220.dll
2007-08-14 00:54 5,632 -ra------ C:\WINNT\system32\kbdhe.dll
2007-08-14 00:54 5,632 -ra------ C:\WINNT\system32\kbdazel.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-14 01:14 2402 --a------ C:\WINNT\pchealth\helpctr\PackageStore\SkuStore.bin
2007-08-14 01:13 8972 --a------ C:\WINNT\pchealth\helpctr\Config\Cntstore.bin
2007-07-30 19:19 92504 --a------ C:\WINNT\system32\cdm.dll
2007-07-30 19:19 43352 --a------ C:\WINNT\system32\wups2.dll
2007-07-04 09:48 132904 --a------ C:\WINNT\system32\drivers\imagesrv.sys
2007-07-04 09:48 11304 --a------ C:\WINNT\system32\drivers\imagedrv.sys
2007-06-27 19:05 972072 --a------ C:\WINNT\UNNeroMediaHome.exe
2007-06-26 16:53 668160 --------- C:\WINNT\system32\dllcache\wininet.dll
2007-06-26 15:57 851968 --------- C:\WINNT\system32\dllcache\vgx.dll
2007-06-26 14:12 972072 --a------ C:\WINNT\UNNeroVision.exe
2007-06-26 08:10 1104896 --a------ C:\WINNT\system32\msxml3.dll
2007-06-26 08:10 1104896 --------- C:\WINNT\system32\dllcache\msxml3.dll
2007-06-19 15:42 282112 --a------ C:\WINNT\system32\gdi32.dll
2007-06-19 15:42 282112 --------- C:\WINNT\system32\dllcache\gdi32.dll
2007-06-15 10:14 96768 --------- C:\WINNT\system32\dllcache\inseng.dll
2007-06-15 10:14 617984 --------- C:\WINNT\system32\dllcache\urlmon.dll
2007-06-15 10:14 55808 --------- C:\WINNT\system32\dllcache\extmgr.dll
2007-06-15 10:14 532480 --------- C:\WINNT\system32\dllcache\mstime.dll
2007-06-15 10:14 474112 --------- C:\WINNT\system32\dllcache\shlwapi.dll
2007-06-15 10:14 449024 --------- C:\WINNT\system32\dllcache\mshtmled.dll
2007-06-15 10:14 39424 --------- C:\WINNT\system32\dllcache\pngfilt.dll
2007-06-15 10:14 357888 --------- C:\WINNT\system32\dllcache\dxtmsft.dll
2007-06-15 10:14 3085312 --------- C:\WINNT\system32\dllcache\mshtml.dll
2007-06-15 10:14 251904 --------- C:\WINNT\system32\dllcache\iepeers.dll
2007-06-15 10:14 205824 --------- C:\WINNT\system32\dllcache\dxtrans.dll
2007-06-15 10:14 16384 --------- C:\WINNT\system32\dllcache\jsproxy.dll
2007-06-15 10:14 151552 --------- C:\WINNT\system32\dllcache\cdfview.dll
2007-06-15 10:14 1498112 --------- C:\WINNT\system32\dllcache\shdocvw.dll
2007-06-15 10:14 146432 --------- C:\WINNT\system32\dllcache\msrating.dll
2007-06-15 10:14 1055744 --------- C:\WINNT\system32\dllcache\danim.dll
2007-06-15 10:14 1022976 --------- C:\WINNT\system32\dllcache\browseui.dll
2007-06-14 12:32 18432 --------- C:\WINNT\system32\dllcache\iedw.exe
2007-06-13 15:23 1034752 --a------ C:\WINNT\explorer.exe
2007-06-13 15:23 1034752 --------- C:\WINNT\system32\dllcache\explorer.exe
--------- C:\Program Files\Usługi online


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTDVDDET"="C:\Program Files\Creative\SBAudigy4\DVDAudio\CTDVDDET.EXE" [2003-06-18 01:00]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2004-09-22 17:54]
"CTSysVol"="C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43]
"CTHelper"="CTHELPER.EXE" [2004-09-23 05:39 C:\WINNT\system32\CTHELPER.EXE]
"UpdReg"="C:\WINNT\UpdReg.EXE" [2000-05-11 01:00]
"NvCplDaemon"="NvQTwk" []
"nwiz"="nwiz.exe" [2002-07-30 15:50 C:\WINNT\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03]
"OSSelectorReinstall"="C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2005-12-27 18:01]
"MonAppli"="C:\windows\system32\msnmsg.exe" []
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57]
"Acronis Scheduler2 Service"="C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe" [2005-12-06 20:58]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 02:44]
"RemoteCenter"="C:\Program Files\Creative\SBAudigy4\Entertainment Center\RcMan.exe" [2004-09-21 11:00]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-06-15 17:34]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-08-21 00:33]
"Creative MediaSource Go"="C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe" [2004-04-29 15:30]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03]
"Shield"="C:\Program Files\Acronis\PrivacyExpert\Shield.exe" [2005-12-06 20:58]

C:\DOCUME~1\Fu\MENUST~1\Programy\AUTOST~1\
OpenOffice.ux.pl 2.2.1.lnk - C:\Program Files\OpenOffice.ux.pl 2.2.1\program\quickstart.exe [2007-07-10 00:18:48]
uTorrent.lnk - C:\Program Files\uTorrent\uTorrent.exe [2007-08-14 19:01:41]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 relog_ap

R0 snapman;Acronis Snapshots Manager;C:\WINNT\system32\DRIVERS\snapman.sys
R2 psh_drv;Process Activity Acronis Monitor;C:\WINNT\system32\DRIVERS\psh_drv.sys
R2 psh_svc;Acronis Malware Shield Service;"C:\Program Files\Common Files\Acronis\Malware Shield\psh_svc.exe"
S0 NVDual;NVDual;C:\WINNT\system32\DRIVERS\nvDual.sys
S3 EMUXMIDI;E-MU Xmidi Driver;C:\WINNT\system32\DRIVERS\EMUXMIDI.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINNT\system32\DRIVERS\USBSTOR.SYS
S3 WFsys;WinFox Control I/O Driver;C:\WINNT\system32\DRIVERS\wfsys.sys

*Newly Created Service* - CATCHME

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-27 08:32:00
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-27 8:33:27

--- E O F ---

[wojtas]

mozesz odinstalowac spokojnie: Desktop Messengera

te pliki:

C:\WINNT\system32\ReWire.dll
C:\WINNT\dsdxirmv.exe

przeskanuj tu:

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty